a538e11edc7e96fdccf4f6c8962fbb8bfc03cae883569cd6c069d5ee0d540aae

Analysis

user interaction
yes
max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solin-Recoil-main.rar
Size 266.5MB
Sample260731-3gccfashka
SHA256 a538e11edc7e96fdccf4f6c8962fbb8bfc03cae883569cd6c069d5ee0d540aae
MD5 dc77f777e1f7bebc5a2cc0dce9373a1b
SHA1 11079aec69e1499ca6adcff2db944d292ba5a120
SHA512 fdb6551759ab469cfda248de53dda6dedd57a09c6a741d7c1686eabb593c7f23ba8bdb66398bec35e5495884b22760a00f9b828b8bec169ad4a7368cb9fecb09
SSDEEP 6291456:kjQ9SLv2aA4xxj54fOjk3RD9kUE8ovyeAjlz5RuZOuji1hDFC:L0v2Fv2A9kUE9vyRjlz5csBC
TLSH
T186D8331395C23BF67601D70EE1D0451E42BA1E463750E20B03BBFABA7D6E68784D9EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Malware Config

Signatures

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
680	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2836	7zFM.exe
584	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2836	7zFM.exe
Token: 35	2836	7zFM.exe
Token: SeSecurityPrivilege	2836	7zFM.exe
Token: SeSecurityPrivilege	2836	7zFM.exe
Token: SeSecurityPrivilege	2836	7zFM.exe
Token: SeSecurityPrivilege	2836	7zFM.exe
Token: SeSecurityPrivilege	2836	7zFM.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe
2836	7zFM.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1744	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
584	OpenWith.exe
916	OpenWith.exe
4368	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 680	584	OpenWith.exe	101

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Solin-Recoil-main.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO41BDF169\Console.cpp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

README.md

Path C:\Users\Admin\AppData\Local\Temp\7zO41BAC0AA\README.md
Size 3KB
SHA256 becc122e6decbed2034aee4c7aba61380cb7c6ed81cc69d7d058866e71faa922
MD5 bf62418e5026b75904c759cecb6cba44
SHA1 ffdadec2201556fed7acbedd17b88b0a4eaca223
SHA512 afb554ed2991bce985eaf67f5db3b2f419d20ee8356c0cf5182dfa7a42a3ab59e573714ea368d61310f61a5afad4b6b5429c9c513c241a87b72efdee41e8e17f
TLSH
T12571769BB64D17E3027302E7530CA2F1E6317258D21A0A5B7C7E526C2350E9093FBADC
MD5 SHA1 SHA512 TLSH

Submit Download

Console.cpp

Path C:\Users\Admin\AppData\Local\Temp\7zO41BDF169\Console.cpp
Size 5KB
SHA256 beb2124518435af359224ac327eac3cb086b5e308b1fb4b4c07129f3705e0cf2
MD5 032eb0ad742fa069d9b5b47524856c57
SHA1 f545318fca8f0f0abc06a6e29336ae4fc99d6718
SHA512 2d735c7088003d355ac03580e586e9536fb79d99e3c928119b923dbfc3512873632a8adfca100b1eb1aff771689c1f544ba51b01e91d40890221813c6195feff
SSDEEP 96:qfFYZ5WR8F6AblruTcP5baszZTCx27pjJqPfIBxbim/B9Kw:dU8Esq0
TLSH
T18FC1D42FC66C3CA7097194A4F95C045E286F2DF3AB714D498F672BBC68125D4A2F1DA0
MD5 SHA1 SHA512 SSDEEP TLSH